MELOPHOS runs on a user's own network: a hub on Wi-Fi, a self-hosted server and a browser app. The full scope, including what is in and out of scope, is in the monorepo's security policy. That file takes precedence where the two differ.
Important
Report privately, never in a public issue. Use GitHub private vulnerability reporting or email security@melophos.com with details and reproduction steps. Expect an acknowledgement within a few days.